Skip to content
uencoder

CORS

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that uses HTTP headers to control whether a page may access resources from a different origin, preventing cross-site reads.

Purpose

It relaxes the same-origin policy to allow legitimate cross-origin API calls while keeping malicious sites from reading cross-origin responses.

Mechanism

The browser adds an Origin header to cross-origin requests. Simple requests are sent directly; preflighted ones go through an OPTIONS check of the methods and headers the server permits. The server authorizes access by returning headers such as Access-Control-Allow-Origin. Credentialed requests additionally require Allow-Credentials.

Use cases

  • Cross-origin API calls
  • CDN fonts and images
  • Frontend aggregation across microservices
  • Third-party SDK integration

Examples

  • Input 
    Origin: https://a.com → https://b.com
    Output 
    b.com returns the ACAO header to authorize

    Preflight followed by the actual request

Common errors

The browser blocks the response when the server returns no CORS headers
Configure the Access-Control-Allow-* headers

Related terms

CSP
CSP (Content Security Policy) declares, via an HTTP header, which resource origins a page may load, shrinking the attack surface for XSS and data injection.
GLOSSARY
Cookie
A cookie is a key-value pair set by the server and stored by the browser, sent automatically with same-origin requests for session and state management.
GLOSSARY
HTTP
HTTP (HyperText Transfer Protocol) is the application-layer protocol of the Web, built on a request-response model, stateless, and the foundation of web communication.
GLOSSARY

References